FileZilla Passive Mode Port Range Behavior When Server Firewall Restricts High Ports

Answer

FileZilla does not automatically adjust its passive-mode port requests to match a server-side firewall-allowed range. The client will only use ports that fall inside the range you explicitly configure (Edit → Settings → Passive mode settings → Use custom port range). If no custom range is set, it picks a random port from the full 1024-65535 range.

Confirmed facts

• When a custom passive port range is defined in FileZilla, each data connection selects a random port from that range.
• The FTP server must be configured to listen on the same range (or a superset) and the firewall must permit inbound traffic on those ports; otherwise the data connection stalls or fails with errors such as "425 Can't open data connection".
• The control connection (port 21) succeeds even when the data connection is blocked, which is why the transfer appears to hang after login.

Likely explanation of the observed behavior

In your local environment the outbound firewall allows any high port, so FileZilla's default random selection works. In production the firewall blocks the high ports that FileZilla happens to pick, causing the data connection to be dropped while the control channel stays alive.

Steps to confirm alignment before moving to production

1. Determine the server's passive port range (e.g., via grep -i passive /etc/vsftpd/vsftpd.conf for vsftpd, or FileZilla Server → Edit → Settings → Passive mode settings).
2. Configure the same range (or a subset) in the FileZilla client under Passive mode settings → Use custom port range.
3. Ensure the server firewall (or any intermediate firewall) explicitly allows inbound TCP traffic on every port in that range.
4. Enable FileZilla's debug log (Edit → Settings → Debug → Show debug log) and initiate a transfer.
5. In the debug log look for the PASV response and the subsequent data-connection line; verify the port number falls within the configured range.
6. Optionally run a packet capture (tcpdump -i any port 21 or portrange X-Y -w ftp.pcap) and confirm that the data-connection SYN packet uses a port inside the range.
7. Complete a test upload/download; the transfer should finish without hanging and the server log should show the data connection on the expected port.

Missing diagnostic detail

To give a definitive recommendation you need to know the server's configured passive port range. Without that value you cannot verify whether the client-specified range aligns with the server firewall.